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HAS THE TSA BREACH JEOPARDIZED NA- 
TIONAL SECURITY? AN EXAMINATION OF 
WHAT HAPPENED AND WHY 


Wednesday, December 16, 2009 

U.S. House of Representatives, 

Committee on Homeland Security, 
Subcommittee on Transportation Security and 
Infrastructure Protection, 

Washington, DC. 

The subcommittee met, pursuant to call, at 2:16 p.m., in Room 
311, Cannon House Office Building, Hon. Sheila Jackson Lee 
[Chairwoman of the subcommittee] presiding. 

Present: Representatives Jackson Lee, Thompson, Cleaver, 
Himes, Dent, Lungren, and Austria. 

Also present: Representative Bilirakis. 

Ms. Jackson Lee [Presiding]. The subcommittee will come to 
order. 

Let me acknowledge the presence of the Chairman of the full 
committee, Mr. Thompson of Mississippi, and Ranking Member, 
Mr. Dent of Pennsylvania. 

Let me welcome those who are here and take a moment of per- 
sonal privilege to acknowledge the family of Mr. Ed Kelly, who, in 
this business, is considered family. 

Many of us gathered after 9/11 in our respective positions. Mem- 
bers of this committee gathered as Members of the Select Com- 
mittee on Homeland Security. Many of us were there from the 
start. Mr. Kelly, comfortably retired, having served as part of the 
excellence of corporate America, decided to render that, if you will, 
for another day and accepted the call to become part of the fighting 
men and women who serve in the Department of Homeland Secu- 
rity. We owe him an enormous debt of gratitude for his service. 

I was privileged to join my colleagues, Mr. Chairman, Mr. Dent, 
the full committee Ranking Member, Mr. King, to send a letter of 
sympathy and was additionally privileged to rise to the floor of the 
House to be able to give him the tribute that he deserves as an 
American hero. 

I would like to have, if I am indulged with unanimous consent, 
to have his family stand at this time so that they might be ac- 
knowledged by all of us. 

[Applause.] 

I believe that is Mrs. Kelly, Ed Kelly’s sister, and niece who are 
present with us today. Thank you all so very much for your pres- 
ence here. 


( 1 ) 
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The subcommittee is meeting today to receive testimony on TSA’s 
inadvertent disclosure of security information related to airports. 
Our witness will help us to assess what transpired and lay the 
groundwork for ensuring that this never happens again. 

Remember, the title of this hearing is, “Has the TSA Breach 
Jeopardized National Security? An Examination of What Happened 
and Why.” 

That is our task, and that is our duty, to protect the homeland. 
The way to do that is to determine what and why and to say, 
“Never again.” 

I now recognize myself for an opening statement. Before I do 
that, we will have aired a film that has been presented previously 
on network television. 

[Begin video clip.] 

Mr. Orr. The breach reveals some of the Government’s most sen- 
sitive aviation security secrets. The 93-page manual prepared for 
Federal airport screeners shows samples of law enforcement and of- 
ficial credentials — Federal air marshals, CIA officers, and Members 
of Congress — IDs which criminals or terrorists could copy. 

The document also reveals travelers from a dozen countries — in- 
cluding Cuba, North Korea, Somalia, and Yemen — are always sub- 
jected to extra screening. 

The Transportation Security Administration says the security 
playbook, prepared in May of 2008, is out of date and the sensitive 
methods have been updated six times, adding in a statement, “TSA 
is confident screening procedures currently in place remain strong.” 

Still, the TSA never meant for this information to be public. 
Each page of the report carries this notice, “Warning: This record 
contains Sensitive Security Information. No part may be disclosed 
without a need to know.” 

The TSA says the whole report was improperly posted by the 
agency on a Government jobs site, with redactions. 

But Wired Magazine editor John Abell says savvy bloggers easily 
restored the blacked-out test. 

Mr. Abell. Clearly, this was a rookie mistake, so let’s just call 
this a very early Christmas present to the kinds of people that traf- 
fic in this kind of secret information. 

Some of the compromised information is just routine common 
sense: “An on-duty airport-assigned law enforcement officer may be 
cleared without undergoing screening.” 

But other guidance may be less intuitive. For example, searches 
for explosive residue are not required for wheelchairs, prosthetic 
devices, and orthopedic shoes. 

The TSA is investigating and says it takes the failure seriously. 
But critics say, with aviation a known terrorist target, it is a little 
late to get serious. 

Mr. Orr. Bob Orr, CBS News, Washington. 

[End video clip.] 

Ms. Jackson Lee. The only early Christmas present that terror- 
ists will get will be the resolve of the men and women of the De- 
partment of Homeland Security, the President of the United States, 
and the men and women of the United States Congress. That is 
why we are here today, to ensure that going forward in this holiday 
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season we have the opportunity to cure quickly the unfortunate 
and vast mistake that has been made. 

So I hope, as we proceed in this hearing, we will hear that steps 
are being taken to ensure the safe travel of the families who will 
be visiting their families during what I hope will be a very happy 
holiday season. 

We are here today, as well, to discuss last week’s revelation that 
a TSA manual containing Sensitive Security Information was post- 
ed by TSA on the internet without proper technical safeguards. As 
a result, sensitive information about our airports and screening 
policies was made available for the world to see. 

My colleagues and I were alarmed by this development, as it sent 
shockwaves across Capitol Hill. This subcommittee takes its over- 
sight of TSA very seriously; after all, TSA was constructed to help 
protect the American people from the very type of events that tran- 
spired on September 11, 2001. 

When events, such as last week’s, are made public, it becomes all 
too clear that more must be done and that TSA must keep its eye 
on the ball. We must also be assured that contractors of varying 
types are, again, vetted, trained, questioned, queried, and if nec- 
essary, be part of the inquisition, because the security of America 
is paramount. 

Today, we will be evaluating how this happened, the security 
ramifications of this misstep, and how we are going to avoid simi- 
lar lapses in the future, and as well, to ensure that those missteps, 
if they can be characterized as such, do not, in fact, jeopardize the 
National security of the American people. 

Before we go further, let me be clear that, although this was a 
serious breach in the management of sensitive information, I have 
been assured by TSA that additional personnel and procedures 
have been put in place at airports across the country to ensure the 
safety of the traveling public. 

In essence, terrorists, watch out. Any terrorist group or indi- 
vidual wishing to exploit this situation should be aware and be- 
ware that the United States will continue to use all available re- 
sources to protect the flying public. During this busy holiday sea- 
son, the American people should know that it is safe to fly, along 
with the courtesies that we expect to be offered by the Transpor- 
tation Security Administration officers, we do expect for them to do 
their duty. 

Last week. Chairman Thompson and I sent a letter to TSA urg- 
ing a third-party review of this incident. I am happy to learn that 
Secretary Napolitano responded and requested that the inspector 
general investigate, take over completely, and provide rec- 
ommendations regarding this incident. I look forward to a quick 
and immediate response. 

In addition, I commend TSA for taking steps in response to this 
incident. For example, I have been informed by TSA that five peo- 
ple have been placed on administrative leave. This subcommittee, 
however, also needs assurance that TSA is reviewing its processes 
for handling and posting of Sensitive Security Information and 
making a full inventory search of all of its staff around these issues 
and ensuring that this is not permeated beyond the five that were 
engaged in this unfortunate set of circumstances. 
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Questions we have include: Who is in TSA’s management — who 
in TSA’s management is ultimately responsible for this process? Is 
there a manual for training employees on how to post such infor- 
mation? What is the role of contract employees in the handling and 
disseminating of sensitive security? What new steps are being put 
in place to vet those individuals on their training, their instincts, 
their knowledge, and as well, their ability to adhere to rules and 
safety precautions? Is there sufficient training for contract employ- 
ees? 

I would also like to know how broadly contract employees are so- 
licited, and how far is the reach, and are we using small and mi- 
nority-owned businesses? Are we using the same ones over and 
over again, therefore, committing the same mistakes over and over 
again? 

One of the lessons made clear by this incident is that TSA needs 
permanent, effective leadership. Our witness today. Acting Admin- 
istrator Rossides, has led TSA during a very active year, and we 
thank her for her service. But the person nominated by the Presi- 
dent to lead TSA, Mr. Erroll Southers, has had his confirmation 
held up in the Senate. 

Let me be very clear: We understand the duties and the constitu- 
tional privileges of the Senate, advise and consent. But what they 
are engaging in, in a partisan, one-sided approach is jeopardizing 
the security of the American people. We need action on his nomina- 
tion immediately, and I hope all stakeholders will also call for his 
swift confirmation. Our homeland security efforts can no longer af- 
ford delay. 

On a personal note, I have already mentioned the passing of a 
TSA family member. But, again, as I close, let me acknowledge 
that Ed Kelly managed TSA’s cargo screening program and testi- 
fied before this subcommittee just this past March. Ed was an in- 
credibly dedicated individual and a consummate professional who 
left retirement, as I said, after September 11 attacks in order to 
work on behalf of our Nation’s homeland security efforts. 

Many in the industry said that he reformed the industry. He 
made leaps and bounds of change and outstanding contributions to 
the security of America. 

Again, on behalf of the subcommittee Members and staff, my con- 
dolences are expressed to his family and to his colleagues at TSA. 

Finally, I would like to point out that this subcommittee under- 
stands the enormity and importance of TSA’s mission and the dedi- 
cation of its employees, but after last week’s announcement about 
the disclosure — and, unfortunately, other incidences — I think we 
can all agree that TSA can do better, and that is why we are here 
today. After a complete analysis of this incident, we will determine 
how to make the agency and its employees perform better and give 
the American people more confidence in the TSA. 

I am considering legislation that will help provide a firewall over 
the issuance and distribution of data like this, along with addi- 
tional oversight on contractors and the utilization of them. 

Without objection, the Chairwoman is authorized to deem the 
subcommittee resolved into Executive Session to receive additional 
testimony, if necessary. 

Hearing no objection, it is so ordered. 
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The Chairwoman now recognizes the Ranking Member, the gen- 
tleman from Pennsylvania, Mr. Dent, who, by the way, joined this 
in his sympathies for Mr. Kelly, but I also note that Mr. Kelly has 
come from his region, if not his particular district. 

Mr. Dent, you are now recognized for your opening statement. 

Mr. Dent. Thank you. Madam Chairwoman. 

I, too, want to add my condolences and sympathies to the Kelly 
family. Ed was a wonderful public servant, served the Department 
of Homeland Security so well and this Nation so well, and our sym- 
pathies — I know I am speaking not only on my behalf, but on be- 
half of the entire community in expressing our condolences to his 
wife, Ann, his sister, Rosemary, and I believe his niece, Elizabeth, 
is here, as well, so, again, from all of us, our heartfelt condolences. 

Again, thanks. Madam Chairwoman. For one thing, too, I note 
the family has a strong connection to northeastern Pennsylvania, 
Lake Ariel, and a very special place for the family and for many 
of us who know Pennsylvania well. 

Again, Madam Chairwoman, I just want to thank you for holding 
this important hearing today. I agree that the TSA’s disclosure of 
this Sensitive Security Information is, indeed, unfortunate, and I 
would add that, based on my review of the situation, TSA’s mistake 
has undoubtedly weakened our aviation security. 

While we have many layers in our aviation security processes, 
some of those layers have been exposed after having the aviation 
security screening management’s standard operating procedures 
posted on a public website for the past 9 months. I agree with com- 
ments made last week from the Federal Law Enforcement Officers 
Association, which stated, “Air marshals and TSOs proudly shoul- 
der considerable risk by virtue of their jobs. Their agency should 
not compound this risk with flawed internal controls and 
dismissive excuses.” 

I ask unanimous consent to include their statement in the 
record. Madam Chair, I would like to ask unanimous consent to in- 
clude their statement in the record. 

Ms. Jackson Lee. Without objection, so ordered. 

[The information follows:] 

Statement of the Federal Law Enforcement Officers Association 
December 9, 2009 

Today, J. Adler, National President for the Federal Law Enforcement Officers As- 
sociation (FLEOA) announced that he is asking House Homeland Security Chair- 
man Bennie Thompson to hold a private hearing on TSA HQ’S security breech. Ac- 
cording to Adler, “Both TSA’s posting of sensitive security information and their un- 
willingness to grasp the seriousness of this are unacceptable. A discreet hearing 
should be held so Congress can determine why TSA posted this information, and 
why TSA attempted to minimize the importance of the information as “outdated.” 
The so-called “outdated” information should not be recklessly discounted like a col- 
lege textbook that is last year’s edition. 

Unfortunately, in response to this serious unwarranted disclosure, TSA HQ has 
offered more “layers” of excuses than assurances of protection. Contrary to their ef- 
forts to deflect their responsibility for making a serious security breach, they do not 
have sound security procedures in play. What they have is a dedicated workforce 
that is tasked with overcompensating for a flawed system. Air Marshals and TSO’S 
proudly shoulder considerable risk by virtue of their jobs; their agency shouldn’t 
compound this risk with flawed internal controls and dismissive excuses. Further- 
more, the careless posting of information pertaining to law enforcement officers fly- 
ing armed only serves to compromise their safety. 
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FLEOA takes great exception to the remarks attributed to former TSA Adminis- 
trator Edmund “Kip” Hawley. His suggestion that no one should “hyperventilate” 
over the breach is offensive and epitomizes the hypocrisy of his tenure at TSA. To 
wit, he unfortunately did not hyperventilate when an external hard drive containing 
employee personnel data disappeared. Instead, he condoned management’s pursuit 
and termination of dedicated Air Marshals who disclosed serious officer safety 
issues to the news media. One can only conclude that TSA HQ has their own set 
of rules that exempts them from accepting responsibility for serious security disclo- 
sures. 

FLEOA expects Chairman Thompson and Ranking Member King will embrace the 
seriousness of the disclosure, as well TSA’S propensity for managing by double- 
standard. TSA HQ should be held accountable for this breach, and a discreet, closed- 
door hearing would be the appropriate forum to properly address this serious mat- 
ter. FLEOA is confident that the committee will be able to persuade TSA HQ to con- 
duct a comprehensive review of this situation, and provide them with a meaningful 
damage-control assessment. 

Mr. Dent. As terrible as this — as the very public nature on 
which TSA’s mistake was disclosed, I am pleased that we know the 
mistake was actually made in the document was accidentally re- 
leased. Now TSA has an opportunity to learn from that mistake. 
The question is, will they? 

Ms. Rossides, I am confident that TSA will. 

While I understand that people make mistakes, my review of this 
incident over the course of the past week has led me to one simple 
conclusion: This was not the failure of an individual, but rather 
that of a failure of a system. 

An individual in TSA’s SSI review office failed to comply with the 
National Security Agency’s processes for electronically redacting 
sensitive information. That individual’s supervisors failed to notice 
it. The Office of Acquisition failed to review the document before 
posting it on the General Services Administration’s FedBizOpps 
website. Finally, management failed to ask why it was necessary 
to post a security-related document on-line for a contract and failed 
to consider viable alternatives. 

On his second day in office. President Obama said, “Trans- 
parency and the rule of law will be the touchstones of this presi- 
dency.” Why then, after more than a week of phone calls, e-mails, 
letters, and in-person requests does this committee still not have 
the most recent version of the standard operating procedures? Sec- 
tion 114(r)(2) of Title 49, United States Code, specifically states 
that designating a document as Sensitive Security Information 
does not authorize information to be withheld from a committee of 
Congress authorized to have the information. That is what the code 
says. 

While I appreciate that my staff was given a 1-hour meeting with 
an additional hour to review the most recent version of the stand- 
ard operating procedures, that is not particularly transparent, in 
my view. After 4 days of asking nicely for the SOPs, Ranking Mem- 
ber Bilirakis and I authored a letter to Ms. Rossides insisting she 
provide the committee the document. Again, I ask unanimous con- 
sent to introduce that letter into the record. 

Ms. Jackson Lee. Without objection, so ordered. 

[The information follows:] 
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Letter For the Record Submitted by Honorable Charles W. Dent 


December 11, 2009 


Ms. Gale Rossides, 

Acting Administrator, Transportation Security Administration, 601 South 12th 
Street, Arlington, VA 28598 

Dear Acting Administrator Rossides: We are writing to formally request an 
immediate copy of the most current version of the Transportation Security Adminis- 
tration’s (TSA’s) Aviation Security Screening Management Standard Operating Pro- 
cedures. The TSA has repeatedly ignored our requests for this document since Tues- 
day, December 8th. TSA’s unwillingness to provide the document is unproductive 
and a violation of law, 

We would remind you that while section 114 of Title 49, United States Code, au- 
thorizes the Transportation Security Administration to issue regulations protecting 
sensitive security information from public disclosure, that same provision specifi- 
cally states that it “does not authorize information to be withheld from a committee 
of Congress authorized to have the information.”^ We would further remind you that 
pursuant to House Rule X(i) of the Rules of the House of Representatives, the Com- 
mittee on Homeland Security oversees “overall homeland security policy” and 
“transportation security.” As such, the law explicitly prohibits TSA’s dilatory tactics. 

As you are aware, in addition to our review, the Subcommittee on Transportation 
Security and Infrastructure Protection will be holding a hearing on TSA’s improper 
disclosure of sensitive airport screening procedures on Wednesday, December 16, 
2009. The Subcommittee needs sufficient time to review the current version of the 
released document to gauge the real impact of TSA’s security failure. 

Thank you for your immediate and personal attention to this matter. 

Sincerely, 


Charles W. Dent, 

Ranking Member, Subcommittee on Transportation Security and Infrastructure 

Protection. 


Gus M. Bilirakis, 

Ranking Member, Subcommittee on Management, Investigations, and Oversight. 


Mr. Dent. Thank you, Madam Chairwoman. 

In the end, you know, a lot of things went wrong, but a lot of 
things are now going right. I understand TSA is taking some risk 
mitigation measures and has taken some immediate common-sense 
actions to prevent any further disclosures. I would hope to the ex- 
tent possible you could highlight some of these during your testi- 
mony this afternoon. 

Finally, to those who re-posted this security information on the 
internet, you should share in the blame should security be 
breached as a result of this disclosure. In the future, I would ask 
that you please, please use the whistleblower process Congress has 
created for you. Call the Department. Call the inspector general. 
Call Congress and its committees. But, please, do not circulate sen- 
sitive security documents. Rest assured, we will hold the Depart- 
ment to account. 

Ms. Rossides, I want you to know that I continue to believe that 
the men and women of TSA, including yourself and your staff, are 
giving your best efforts to improve the security of the traveling 
public. While the accidental disclosure was certainly disappointing 
and the lack of transparency provided by this administration is 
frustrating, I am committed to working with you to improve the 
Transportation Security Administration and the services it pro- 
vides to our traveling public. 

With that, I would yield back the balance of my time. 

Ms. Jackson Lee. I thank the gentleman for yielding back. 


149 use §114(r)(2). 
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It is my privilege to acknowledge and recognize the Chairman of 
the full committee, the gentleman from Mississippi, Mr. Thompson, 
for an opening statement. Mr. Chairman. 

Mr. Thompson. Thank you very much. Madam Chairwoman, I 
appreciate the holding of this hearing. 

I would also like to take the opportunity to express my condo- 
lences to the Ed Kelly family, as well as his TSA colleagues who 
are here. Ed was a dedicated public servant, and his efforts in the 
cargo security will never be forgotten. 

There is no doubt that the events that transpired last week raise 
several questions about TSA’s operational procedures and practices 
in handling sensitive information. Perhaps more importantly, this 
incident also raises concerns about the security of our entire trans- 
portation system. 

No actions, legislation, or press statement can undo the disclo- 
sure of this information. However, we can learn from this incident 
and move forward with security measures that ensure sensitive in- 
formation will not be made available to the public. 

The events from last week serve as a reminder of how critical it 
is to have accountability at the Department of Homeland Security. 

I think it was the right decision for Secretary Napoli tano to re- 
quest that the DHS inspector general begin an investigation of this 
incident. The review and investigation by the inspector general is 
an important first step in learning the details that will be essential 
in helping TSA improve procedures for handling and posting sen- 
sitive material. 

However, as I have said before, to get TSA to improve its oper- 
ational performance in all program areas and at all levels of man- 
agement, it is essential that TSA have permanent, effective leader- 
ship. The President has nominated Erroll Southers to be TSA ad- 
ministrator, and I think we have waited long enough for his con- 
firmation. 

His law enforcement background and operational experience will 
be essential in improving TSA and strengthening our homeland se- 
curity efforts. With strong leadership is in place, incidents such as 
these are less likely to happen. 

Nevertheless, today’s hearing provides us in Congress with an 
opportunity to express our concerns and to hear from TSA about 
what it plans to do. I am sure that we will need follow-up briefings 
and perhaps another hearing to review the inspector general’s re- 
port and to assess steps going forward. 

Madam Chairwoman, there are some questions that I have after 
we have heard from our witness that would more or less enlighten 
us, I think, on this situation. But I am concerned about it. I will 
express those concerns during the question-and-answer period. I 
yield back. 

Ms. Jackson Lee. To the Chairman of the full committee, let me 
also express my appreciation for the astuteness and the detail of 
which the committee, with you as Chair, and the staff has taken 
to securing the homeland. I think this committee reflects that, and 
your cooperation and agreement with this subcommittee’s intent to 
hold a hearing is much appreciated. Again, thank you very much 
for your leadership. 
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I wish to recognize — I think hoth of us are going to speak in tan- 
dem here on the gentleman from Florida, Mr. Dent. 

Mr. Dent. Madam Chairwoman, I was going to ask unanimous 
consent that Ranking Member Bilirakis of the Management, Inves- 
tigations and Oversight Subcommittee be authorized to join us on 
the dais and ask questions of the witnesses. 

Ms. Jackson Lee. As you ask, I am ordering that Mr. Bilirakis 
be allowed to sit on this committee and participate with questions 
through the unanimous consent. 

Any objection? So ordered. 

Let me acknowledge Mr. Bilirakis’ presence, Mr. Austria’s pres- 
ence, and Mr. Cleaver’s presence, and thank them for being here 
today. 

Other Members of the subcommittee remind me that under com- 
mittee rules opening statements may be submitted for the record. 

Our witness today, Ms. Gale Rossides, is the acting adminis- 
trator of TSA. As I indicated previously, we are grateful for her 
service, her long-standing service. As acting administrator, Ms. 
Rossides oversees a workforce of 50,000 people and the security op- 
erations of 450 federalized airports throughout the USA, as well as 
the Federal security regime for highways, railroads, ports, and 
mass transit systems. 

Ms. Rossides was one of the six original Federal executives hand- 
picked in 2002 to build TSA. Let me say that deserves commenda- 
tion, and we thank you for that longevity of service. 

Without objection, the witness’s full statement will be inserted in 
the record. I now ask Ms. Rossides to summarize her statement for 
5 minutes. 

You are recognized for 5 minutes. 

STATEMENT OF MS. GALE ROSSIDES, ACTING ADMINIS- 
TRATOR, TRANSPORTATION SECURITY ADMINISTRATION, 

DEPARTMENT OF HOMELAND SECURITY 

Ms. Rossides. Good afternoon. Chairwoman Jackson Lee, Rank- 
ing Member Dent, and Chairman Thompson, and distinguished 
Members of the subcommittee. 

First of all, I want to thank you for recognizing the services of 
Ed Kelly and his family. He was truly one of our heroes in TSA. 

I appreciate your giving me the opportunity today to speak with 
you about the recent website posting of an improperly redacted 
version of a management standard operating procedure, or SOP, on 
a Federal website. I regret this occurred and take full responsibility 
for this mistake. Our response was swift, decisive, and comprehen- 
sive, because our priority first and foremost is the safety of the 
traveling public. 

I want to reassure all Members of this committee and the trav- 
eling public that our aviation system is strong and the passengers 
will fly safely this holiday season and every day because of the lay- 
ered security system we have in place. 

From cutting-edge new technology to retraining our entire work- 
force to the implementation of new security programs, we have 
evolved and substantially strengthened security in the year-and-a- 
half since this document was drafted. 
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On Sunday, December 6, I became aware that the screening 
management SOP was posted to the Federal Business Opportuni- 
ties website without having the Sensitive Security Information, or 
SSI, properly redacted. The document was an attachment to a 
screening partnership program contract solicitation. 

We took immediate action. I convened a teleconference with 
TSA’s senior executives, and we notified DHS headquarters on 
Sunday night. Also on Sunday night, we removed the document 
from the Government website within hours, thanks to prompt work 
by the General Services Administration. 

I then directed TSA’s Office of Inspection to immediately begin 
a review of what happened and how, and that review has since 
been passed on to the DHS inspector general. Our Security Oper- 
ations Office conducted an operational assessment of any potential 
vulnerabilities that this disclosure may have caused. Out of an 
abundance of caution, we quickly put mitigation measures in place 
to close any potential gaps. 

I directed an audit of sensitive information posted both internally 
and externally to be conducted by the chief information officer. We 
consulted with our Federal and law enforcement partners and 
stakeholders throughout the aviation domain, and all have been 
tremendously supportive. 

There have been numerous and significant changes in our evolv- 
ing security program that are not contained in the May 2008 
version of this SOP. 

As a point of reference, this document provides instructions on 
who and what needs to be screened. It does not include the specific 
procedures used by our transportation security officers to screen 
members of the traveling public. 

Today, TSA’s 12 other standard operating procedures, including 
the ones that cover an officer’s screening procedures, remain se- 
cure. The strength of our dynamic security system is in our own 
people, our technology, our stakeholder partnerships, and our mul- 
tilayered and complex protocols. 

We take this matter very seriously and look forward to the in- 
spector general’s report. Our response to their recommendations 
will also be swift. We will hold individuals accountable as appro- 
priate. At this time, five TSA employees have been placed on ad- 
ministrative leave, pending the outcome of the continued investiga- 
tion. 

This has been a critical incident for TSA, and we have managed 
it as such. From an exhaustive internal review, we will emerge 
with stronger internal document control measures for all employ- 
ees. We will strengthen the electronic processes we use for sharing 
information. Most importantly, we will continue to evolve our secu- 
rity programs in light of intelligence and our own testing and train- 
ing regime to ensure the on-going security of the system. 

In closing, I want to again assure Members of this committee, 
the traveling public, and our partners that our Nation’s aviation 
system is strong. We have closed any potential gaps, and we will 
continue to apply measures that enhance our complex security sys- 
tem. 

I am happy to answer your questions and can discuss any sen- 
sitive material in the closed session to follow. Thank you. 
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[The statement of Ms. Rossides follows:] 

Prepared Statement of Gale D. Rossides 
December 16, 2009 

Good afternoon Chairwoman Jackson Lee, Ranking Member Dent, and distin- 
guished Members of the subcommittee. Thank you for the opportunity to appear 
today to discuss the recent website posting of an improperly redacted version of a 
2008 Transportation Security Administration (TSA) Screening Management Stand- 
ard Operating Procedure (SOP). I appreciate the subcommittee’s continued involve- 
ment in the security operations of TSA, and look forward to working closely with 
Congress in fulfilling our on-going mission to safeguard all sectors of transportation 
on behalf of the American people. 

Let me begin by assuring the Members of the subcommittee and the traveling 
public that our aviation security procedures remain strong. The duties performed by 
TSA’s dedicated workforce of Transportation Security Officers (TSOs), Federal Air 
Marshals, canine teams, and others have not been adversely impacted by this inci- 
dent. TSA will continue to ensure the same high standard of security during the 
upcoming holiday season that was evident throughout the Thanksgiving Day travel 
period. Our workforce is responsive, accountable, and dedicated to safeguarding the 
traveling public, and neither our capability nor our resolve has been diminished by 
this incident. 

Those who seek to infiltrate airport security will find no roadmap from the re- 
dacted text that was improperly released. This document, which was outdated, pro- 
vides procedural information for managers. It is not the SOP used by our TSOs at 
airport checkpoints to screen members of the traveling public. Because we contin- 
ually adjust our SOPs and our security protocols based on the receipt of intelligence 
information and the testing of our security regimen, there have been six newer 
versions since this SOP was drafted. Our TSO screening procedures have not been 
compromised, and our multi-layered transportation security system remains intact. 
Nonetheless, out of an abundance of caution, we have undertaken an operational as- 
sessment of any potential vulnerabilities that this disclosure may have caused, and 
have taken swift action to prevent the information from the SOP from being used 
to defeat a single point in our multi-layered security system. 

That being said, TSA, and I personally, take this incident very seriously. This was 
a mistake and we are very sorry it occurred. I would like to provide a brief summary 
of the events surrounding this incident. On Sunday, December 6, TSA’s Blog Team 
learned that a 2008 Screening Management SOP posted on the General Services Ad- 
ministration’s (GSA) Federal Business Opportunities website contained redacted in- 
formation that had not been properly protected. The SOP had been posted by TSA 
on the GSA contracting website for a contract solicitation under TSA’s Screening 
Partnership Program. Such documents — when properly redacted — are used in con- 
tract solicitations to guarantee fairness in the procurement process. Unfortunately, 
the redaction on this particular document had been performed incorrectly, enabling 
readers to view the redacted portions as well as the headers and footers indicating 
that the document contained Sensitive Security Information (SSI). 

TSA takes any breach of its security programs very seriously, and we reacted 
swiftly. I convened a Sunday evening senior staff conference call as soon as I 
learned of the improperly redacted document, notified the Department of Homeland 
Security’s headquarters, and ordered that GSA be notified and immediate steps be 
taken to remove the document from the GSA website. Although this happened 
promptly and GSA cooperated fully with our request within 2 hours, outside individ- 
uals had already downloaded the document and made it available on their websites. 

We initiated an extensive internal review through the TSA Office of Inspection 
and placed the employees who were involved with the redacting of the document on 
administrative leave pending completion of the review. Secretary Napolitano also 
asked the Department’s Inspector General (IG) to conduct a thorough investigation 
of the matter, which we are currently engaged in now. 

Since this incident, we have also instituted even more stringent new safeguards 
for all sensitive operational documents to ensure that no SSI is improperly released. 

In closing, I deeply regret that this incident occurred. We have taken immediate 
actions and look forward to working with the IG on implementing any recommended 
actions in the future. 

I am confident that through an exhaustive review of the facts and circumstances 
surrounding this incident, TSA will emerge a stronger agency. 

Thank you for your continued assistance to TSA and for the opportunity to discuss 
this matter with you today. I would be pleased to respond to your questions. 
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Ms. Jackson Lee. Allow me to thank you for your testimony and 
to now yield myself 5 minutes for questioning. 

Before I do that, let me acknowledge the presence of Mr. Himes, 
a Member of the committee. Other Members will be recognized in 
the order in which they have arrived. 

Ms. Rossides, thank you for the initial steps that have been 
taken. Let me just ask one pointed question, because when we 
started this unfortunate incident, and a lot of hysteria was created, 
both in terms of the media reporting it really looked devastating. 
Tell me what level of participation now is the IG? How comprehen- 
sive is the IG’s investigation? 

Ms. Rossides. Madam Chairwoman, they are specifically looking 
at what happened, who was involved, how did it happen, and what 
measures and recommendations can they make to TSA so that it 
does not happen again. They are looking at both papers, and they 
are doing an extensive forensics on the technology, looking at the 
electronic transmission of the document. 

Ms. Jackson Lee. On the SOP, did you indicate that Members 
could have individual classified or confidential briefings on the new 
procedures? 

Ms. Rossides. Yes, Madam. We have offered and we will con- 
tinue to offer, as we go through this process, briefings to any of the 
Members or their staff on the current SOP that is in place across 
the aviation system so that the Members can get a full under- 
standing and appreciation of the fact that many systems improve- 
ments have been put in place since that version in 2008 was draft- 
ed. 

Ms. Jackson Lee. What is your best assessment of whether or 
not the lives of Americans are now presently at jeopardy or in jeop- 
ardy because of information that is already disseminated? What we 
are speaking of here is a pullback of what occurred and an inves- 
tigation of why. But now that information has been disseminated, 
where are we with respect to security, as it relates to the traveling 
public? 

Ms. Rossides. Madam Chairwoman, the system is very strong, 
and I am very confident in saying that for several reasons. First 
of all, there were six versions or updates to the document that was 
released that had very significant changes to the way we conduct 
the screening procedures. 

Secondly, this was a management’s standard operating proce- 
dure; in other words, it had a lot of checklists of what to do to start 
the day at the checkpoint. It did not have a lot of Sensitive Secu- 
rity Information on how to actually do certain procedures at the 
checkpoint. 

That being said, I appreciate the gravity and the significance 
with which people regarded this. But we knew and our immediate 
reaction was to begin to do a line-by-line review of that document, 
compare it to measures in place today, and, frankly, even with the 
confidence we had, out of an abundance of caution, we immediately 
took some additional measures which we do any time we get infor- 
mation that says, “Let’s put an additional set of measures in place 
in order to be that much more confident in the system.” 

Ms. Jackson Lee. Is it safe to say that you have changed the 
review procedures? Is it also — I am asking several questions at 
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once, so you might want to make note. The review — or the process 
that administers the SSI — meaning the document — prior to making 
the document available to the general public, to review those proce- 
dures, is it safe to say that, as the public is traveling, that there 
are new schemes and procedures that no one knows about? 

Lastly, let me just hold this up. This is an example of the kinds 
of cards that were displayed. Some others dealt with law enforce- 
ment officers who need to have confidentiality and privacy. The 
question is, should we begin to change all of these IDs in order to 
ensure the safety of those who are in the service of their Govern- 
ment? 

Ms. Rossides. Madam Chairwoman, let me answer your ques- 
tions and make sure that I am fully responding to your several 
questions. 

First of all, with respect to the review of the procedures, there 
were several things we did. We began our information protection 
oversight board, which is a board we established several years ago, 
to look at incidents like this. We also — I asked that, even though 
SOPs be treated in their entirety as SSI, I asked that we just hold 
and not release any other SOPs until we could get a complete re- 
view of what had been released and what the circumstances were. 

I also directed the Office of Acquisition to look at all of their cur- 
rent and recent postings for procurement solicitations and take 
down any that had any other relevant SSI or sensitive information 
in them and to make sure that they looked completely at those, 
which, to the best of my knowledge, we had no other. 

We put in a number of measures, mitigation measures that are 
part of the flexibilities that we have across the system. Federal se- 
curity directors on Monday morning were directed to implement 
some of those other flexible provisions so that we would ensure the 
safety of the traveling public. 

I would like to specifically, you know, describe the ID that you 
show. Although, you know, we take full responsibility and we are 
not at all pleased that this document was released, those IDs in the 
document are photocopies. I just want to assure you and the trav- 
eling public and our law enforcement partners, there are other as- 
pects to those identifications and credentials that have security fea- 
tures to them, and we have extensive procedures in place to vali- 
date the authenticity of persons traveling through that represent 
themselves as law enforcement officers. In fact, some of those im- 
provements we have made have been at the direct urging of this 
committee. 

Ms. Jackson Lee. I thank you. Administrator, and now yield 5 
minutes to the Ranking Member, Mr. Dent. 

Mr. Dent. Thank you. Madam Chairwoman. 

Thanks, Ms. Rossides, for being here today. The President, as 
you know, has stated repeatedly that the administration would em- 
brace the spirit of transparency. The day after his inauguration, 
the President stated, “Transparency and rule of law will be the 
touchstones of this presidency.” 

Are you familiar with Section 114(r), which authorizes TSA to 
prescribe regulations prohibiting the disclosure of Sensitive Secu- 
rity Information? 

Ms. Rossides. Yes, sir, I am. 
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Mr. Dent. Can you please explain your interpretation of the Con- 
gressional exemption included in Section 114(r)(2)? 

Ms. Rossides. My understanding is that, when TSA receives a 
request like this, we are required to provide it to the Congress 
when it is received from the leadership of a committee, and we do 
that when we are properly requested. 

Mr. Dent. Do you have a certain date when you will he transmit- 
ting to the Committee on Homeland Security a copy of the current 
document, such as today, you know, next week, you know, any date 
certain after the new year? 

Ms. Rossides. Mr. Congressman, what I will pledge to you is 
that, in the aftermath, the immediate aftermath of this, we wanted 
to exercise the absolute operational security over all of these SOPs. 
My commitment to you is, once we are through the traveling holi- 
day season, I will come back and I will talk with you and the lead- 
ership of this committee about how to make all of that information 
available to you. In the meantime, we will sit and give briefings to 
any Members or their staff that requested on this document specifi- 
cally. 

Mr. Dent. You know, I certainly appreciate that TSA provided 
my staff about an hour briefing on the differences between these 
two documents. Then I think there was about an hour to review 
the latest version of the document, but I want to make sure that 
I am clear that I still would like to have a hard copy of the docu- 
ment for a thorough review. 

I guess the question still is why does TSA not want to provide 
the committee with a hard copy of this document, given that we 
have asked for thousands of pages of Sensitive Security Informa- 
tion in the past and TSA has provided them? Why is this different? 

Ms. Rossides. The only reason this is different right now is in 
the immediate aftermath of this incident. I was very concerned to 
maintain the tightest controls over the current version, because it 
does have very significant changes to what was released. I just 
wanted to take the absolute measures to protect that information, 
and that is why a hard copy wouldn’t be presented, but we were 
very, very willing to provide the information and actually explain 
the difference in the versions from one document to the other. 

Mr. Dent. I thank you for that answer. I keep hearing that the 
administration is reviewing our request for an unclassified docu- 
ment, and I guess the question is, where are you in that review? 
Who, if anybody, would be holding up the documents from being 
provided to our committee? Is it the TSA? Is it DHS, the White 
House? 

Ms. Rossides. Right now, sir, it is — ^basically, the request is 
pending and that ultimate decision would be mine or the Sec- 
retary’s to make. Those are the — under the regulation, we are the 
two officials with the authority to make the decision to release it. 

Mr. Dent. Well, speaking for the Republican side of this com- 
mittee, I just really would, again, request that we get a date cer- 
tain for that document. As I have said, we have received, thou- 
sands of pages of — Sensitive Security Information and it has never 
been an issue, but this one seems to be. I understand the issue that 
you and I have talked about with the travel season being upon us 
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here, but certainly it would be, I thought, reasonable to have a date 
certain, some time early in the new year. 

Ms. Rossides. I will get back to you, sir. 

Mr. Dent. Finally, after the TSA asked the General Services Ad- 
ministration to review the document from its website, it removed 
it in about 2 hours, but not before being captured and then re- 
posted by various other websites. Do the current regulations pro- 
vide you a mechanism to keep individuals from reposting this infor- 
mation on other websites? 

Ms. Rossides. No, sir, they do not. We do not have any authority 
to ask non-Government or non-DHS sites to take it down. 

Mr. Dent. What action did TSA intend to take against those who 
are reposting this sensitive document that should not be in the 
public domain? 

Ms. Rossides. Well, right now, there really isn’t any authori- 
tative action we can take. Honestly, persons that have posted it, I 
would, you know, hope that out of their patriotic sense of duty to, 
you know, their fellow countrymen, they would take it down. But, 
honestly, I have no authority to direct them and order them to take 
it down. 

Mr. Dent. So there is nothing in current regulations that provide 
you a mechanism to compel they remove this information? 

Ms. Rossides. No. 

Mr. Dent. I yield back. 

Ms. Jackson Lee. Thank you very much. 

Just as I yield to Chairman Thompson, let me be very clear. Ad- 
ministrator Rossides, that there is a view by the majority — and I 
appreciate the comments of the Ranking Member — that we want to 
see the inspector general’s work completed before any public dis- 
tribution of these items, the SOP in particular, because there is 
concern about the impact on National security. 

I would encourage Members to take full advantage of the per- 
sonal review of documents, but we ask you to urgently move for- 
ward, as our Ranking Member has indicated, and we are going to 
be following this through the holiday season and into the beginning 
of the year. 

I now am pleased to yield 5 minutes to the Chairman of the full 
committee, Mr. Thompson. 

Mr. Thompson. Thank you very much. Madam Chairwoman. 

Just for timeline purposes, Ms. Rossides, can you tell the com- 
mittee when this particular posting went up on the web and when 
TSA found out about it? 

Ms. Rossides. Yes, sir. It went up in March 2009. It was part 
of a solicitation for the SPP program. It came to my attention and 
senior leadership’s attention on Sunday, December 6, in the early 
evening. 

Mr. Thompson. So this particular item was in the public domain 
from March until December? 

Ms. Rossides. Yes, sir. 

Mr. Thompson. Well, I guess one of my concerns is you said you 
took swift, decisive, and comprehensive action. That is after you 
found out. 

Ms. Rossides. Correct. 
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Mr. Thompson. So before that, it was in wherever. I guess, what 
are the — can you explain to the committee the protocols for putting 
items on the web? 

Ms. Rossides. Yes, sir. At least through the acquisition process, 
there are two approaches when we post procurement actions. One 
is to — when we have any kind of sensitive information, one is to 
post it to the secure side of the GSA FedBizOpps site, which means 
that it is password-protected or otherwise secured. The other is so- 
licitations get posted to FedBizOpps’ unsecured side. 

This particular solicitation got posted on their unsecured side 
and then was not properly redacted. The — there are other ways 
that we also will give potential vendors the opportunity to look at 
SSI information and procurement actions. We might have a phys- 
ical reading room where we invite the vendors in, and then they 
can look at that — any SSI material in a physical reading room. 

Mr. Thompson. Thank you. Now, was this a private contract, 
who did this, who did this posting? 

Ms. Rossides. That is within the scope of the IG’s review right 
now. I can’t really comment, because of the IG’s due diligence on 
determining exactly who did what postings. There was a contractor 
under the SSI office at the time, a contract company under contract 
with the SSI office. 

Mr. Thompson. Why would we have a contractor in the SSI of- 
fice? 

Ms. Rossides. Small contracts like that often just provide clerical 
support. Sometimes they provide research support. Sometimes they 
provide some technical support. They are not people that are mak- 
ing the decisions on the technical aspects of a job, in terms of like 
the redactions. 

Mr. Thompson. Are they required to have clearances? 

Ms. Rossides. Yes, sir, they are. 

Mr. Thompson. Did all these employees in question here have 
clearances? 

Ms. Rossides. That I cannot answer specifically, but during the 
scope of the IG review, we will know exactly what clearances every- 
body did have and the particular people involved. 

Mr. Thompson. Well, you have already suspended five people. 

Ms. Rossides. Yes, sir. 

Mr. Thompson. I would hope that part of your review would 
have looked at whether or not these clearances were in effect. 

Ms. Rossides. The five people who were put on administrative 
leave do have clearances, yes, sir. 

Mr. Thompson. Well, but the — to your knowledge, these are not 
all the people who had access to what we are talking about. Am 
I correct? 

Ms. Rossides. Exactly, sir. As part of the IG’s review, they will 
determine if it was confined to just these five or if, in fact, there 
are more people who are responsible for this error. 

Mr. Thompson. For the committee’s point of information, how 
did we find out about this — how did TSA find out about this post- 
ing? 

Ms. Rossides. I found out from a blogger notifying our blog 
team. We have a TSA blog team. A blogger who frequently blogs 
on TSA’s blog called and sent an e-mail to one of our bloggers and 
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pointed it out. That followed a chain of events of my being notified 
of it. 

Mr. Thompson. So the particular software that was used to do 
the redacting, is that a TSA-approved software? 

Ms. Rossides. Any of the software on TSA computers are ap- 
proved by our chief information officer. 

Mr. Thompson. Did that chief information officer understand 
that it could be unredacted on the web? 

Ms. Rossides. That will be part of what we learn in the IG re- 
view, exactly which software, what version of the software, and 
what version was on the various computers that actually touched 
this document. 

Mr. Thompson. So we don’t know? 

Ms. Rossides. I do not know yet. 

Mr. Thompson. I would take that you have talked to the chief 
information officer? 

Ms. Rossides. Yes. They are going through and looking at all of 
the versions of the software on TSA computers now, and they are 
going through that inventory right now, with the goal being that 
we will ultimately have the same software on all computers, and 
everybody will be properly trained to that software. 

Mr. Thompson. Is there a software presently being used by TSA 
that can’t be unredacted? 

Ms. Rossides. Yes, sir, there is. 

Mr. Thompson. Have we made that software available to every- 
one who is doing posting on the web for TSA? 

Ms. Rossides. Yes, sir, we have. We are going back and making 
sure that everybody who is using that software is properly trained 
and knows, again, how to properly use that software. If I could add, 
had this software been properly used, it would have worked on this 
document, so we are making sure that everybody who deals with 
SSI information 

Mr. Thompson. Wait a minute. You just told me you don’t know 
which software — ^you mean, this 

Ms. Rossides. The software in use, the software that our CIO 
uses today and authorizes, if that software was used 

Mr. Thompson. Okay. I got you now. 

Ms. Rossides [continuing]. It would have worked. 

Mr. Thompson. But you don’t know which software was used? 

Ms. Rossides. Exactly. 

Mr. Thompson. Okay. Thank you very much. 

I yield back. Madam Chairwoman. 

Ms. Jackson Lee. I thank the Chairman. 

Now I recognize Mr. Austria. 

Mr. Austria. Thank you. Madam Chairwoman and Ranking 
Member Dent. I would just like to lend my voice to those who are 
deeply troubled by this incident. It is extremely concerning to me 
that here we sit, 8 years after 9/11, and our Government, whether 
it be accidental or carelessness, can make such a mistake as post- 
ing sensitive information on a website. 

I am very concerned about that. I am very concerned with the 
fact that TSA posted the standard operating procedures, that the 
Federal Government with this incident may have inadvertently 
helped those that we don’t want to see this information, terrorists. 
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others, do their homework for them, so to speak. I am very con- 
cerned about that. 

So let me — if I may, I have a number of questions here. I am 
going to get right to my questions. But, Ms. Rossides, thank you 
for your testimony today. 

Let me, first of all, ask you — kind of following up on the Chair- 
man’s questions on redaction — how often does the TSA post re- 
dacted standard operating procedures on the internet? What is the 
purpose of that? 

Ms. Rossides. Sir, this was the first time that we had ever post- 
ed a standard operating procedure for a procurement solicitation, 
and it was done specifically for the procurement, for companies to 
compete for privatizing airports in the State of Montana. 

Mr. Austria. Let me follow up on that answer, because my next 
question would be, why would TSA post any of its standard oper- 
ating procedures, sensitive or not? I understand that the entire 
document may not have been security sensitive, but there were 
parts that the general public should not have seen. Why would you 
post anything? Why would you give anyone the opportunity to 
learn anything about TSA’s aviation security procedures? 

Ms. Rossides. In the course of that particular solicitation, any 
vendors will have to be able to prove that they can provide the se- 
curity procedures at those airports. So they needed to know what 
kind of requirements we would have at checkpoints for them to be 
able to demonstrate their qualification to be a qualified vendor to 
be considered for this contract. 

Beyond that, one of the questions that the IG is asking is, why 
did we take the steps that we did? They are reviewing that decision 
in terms of, why was it posted? 

Mr. Austria. Let me follow up on this question again, but what 
is the purpose of posting this? Why does TSA post this on the inter- 
net? What is the purpose of that? 

Ms. Rossides. The purpose was for a procurement action. It is 
not something that we post routinely. It was for a specific procure- 
ment action that this particular SOP was posted. 

Mr. Austria. So going forward, will TSA continue to use the 
internet to post redacted Sensitive Security Information for poten- 
tial contractors or vendors? Or have you changed the way you are 
doing business? 

Ms. Rossides. We have immediately — I have immediately di- 
rected the Office of Acquisition to not post any SOPs like this. 
What we will review with the General Services Administration is 
ensuring that if we ever do have to post solicitations again — say, 
for the technology purchases that we are doing — that would contain 
any SSI information, we will verify that that is in a secure environ- 
ment on their secure website. 

We are also looking at other measures, physically inviting poten- 
tial vendors in to look at material, as opposed to doing any postings 
at all. 

Mr. Austria. Okay. I appreciate that answer. 

Let me kind of follow up a little bit on what the Chairman was 
talking about as far as redacting the sensitive documents, because 
I think that is very important. Can you tell us, as a committee. 
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what TSA’s normal process and procedures are for redacting sen- 
sitive documents? 

Ms. Rossides. Yes, sir. The normal process is that within pro- 
gram offices that have SSI information, there is a designated indi- 
vidual who is trained to properly redact the materials. The chief in- 
formation office puts out the instructions on how to properly redact 
information, based upon the technology that is on each individual’s 
computer. 

That process now we are going back and reviewing, both as part 
of the IG review, in terms of how did this actually happen, and 
then now, what our CIO is also doing is making sure that the same 
software for redacting is on all computers, so that the training is 
consistent from office to office to office. 

Mr. Austria. Okay. One last question I have — I know my time 
is up. Madam Chairwoman. 

Ms. Rossides, based on what has happened here, do you believe 
that our aviation security has been compromised or weakened be- 
cause of this incident? 

Ms. Rossides. No, sir, I do not. 

Mr. Austria. Thank you. Madam Chairwoman. 

Ms. Jackson Lee. Thank you. 

The gentleman from Missouri is recognized, Mr. Cleaver, for 5 
minutes. 

Mr. Cleaver. Ms. Rossides, thank you for being here. 

To follow with Mr. Austria’s, the answer to that question would 
have been what you just said no matter what, right? 

Ms. Rossides. Yes, sir. I believe that our system is very strong. 

Mr. Cleaver. No, no, no. I mean, but even if it weren’t, that that 
would be the answer, right? 

Ms. Rossides. I don’t understand. 

Mr. Cleaver. I mean, you wouldn’t have sat here in front of, you 
know, TV cameras that our system has been compromised. 

Ms. Rossides. I believe that the system is very strong and it was 
not compromised as a result of this, sir. 

Mr. Cleaver. Okay. I understand why you won’t answer the 
question, which is why I asked the question. But that was some- 
what of an answer. Has there been a — see, I don’t — I am not sure 
you can answer my questions here, because I don’t — because 

Ms. Rossides. I can — perhaps when we get into the closed ses- 
sion, I can answer and give you more examples as to why I am con- 
fident in our systems. 

Mr. Cleaver. Well, generally, whether it is science or theology 
or anthropology or epidemiology, we all build on what was. So it 
seems to me that any new versions were built on older versions. 
Am I right about that? 

Ms. Rossides. Yes, sir. 

Mr. Cleaver. Okay. So if I am correct, then there obviously is 
information that is out there that is in the latest iteration. 

Ms. Rossides. That is true. But that — the bulk of that informa- 
tion is not SSI information. It is checklists. It is routine standard 
procedures. 

Mr. Cleaver. The SSI material was posted on the fob.com on 
March 3, but it was not discovered by TSA until December 6. What 
was the — what happened differently in between time? 
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Ms. Rossides. The procurement solicitation was up on the 
FedBizOpps website. In fact, the procurement went through its 
whole process. A contractor was selected for that procurement. 
Then the normal routine is, once the contract is awarded, the GSA 
keeps the procurement award posted on the FedBizOpps and ad- 
vises the public, who actually won the contract. 

Mr. Cleaver. Okay. Unfortunately, it sounds like we have been 
called to vote. The questions that I have, based on what you are 
saying, I am not sure I want answered. I mean, I don’t think you 
will answer it in front of everybody in the first place. 

So I don’t want to ask it, because then I get frustrated, because 
you can’t answer it. On top of that, I appreciate you not answering 
it — sounds clear. 

Ms. Rossides. Well, if we have the opportunity to go into the Ex- 
ecutive Session, perhaps I can give you some answers that won’t 
frustrate you and will be able to give you more information. 

Mr. Cleaver. But you understand the 

Ms. Rossides. Yes, sir, I do. I understand. 

Mr. Cleaver. Madam Chairwoman, thank you. 

Ms. Jackson Lee. I thank the gentleman. 

The gentlelady is correct. If we are prepared to go into Executive 
Session — we are called for a vote. We are going to continue for a 
period of time. 

I do want to ask the administrator on her time circumstances 
here. I see the number of Members, but we do want to pose that 
question to you. What is your time circumstance, please? 

Ms. Rossides. You know, probably. Madam Chairwoman, I have 
got to be out of here by about 4:15. 

Ms. Jackson Lee. 4:15. 

Ms. Rossides. Yes, ma’am. 

Ms. Jackson Lee. Let me now recognize — and we will con- 
template what our next step is. Let me recognize Mr. Lungren for 
5 minutes. He is not a Member of the committee — yield to — ^but we 
are graciously accepting him, but we are going to Members first. 

Mr. Himes is recognized. 

Mr. Himes. Thank you. Madam Chairwoman. A couple of quick 
questions. 

Eirst, I share my colleagues’ concern, obviously, with this disclo- 
sure of sensitive information. Of course, no organization doesn’t 
make mistakes. The measure of an organization is how well you 
learn from your mistakes. It sounds like you have taken a fairly 
aggressive approach to that. 

Here’s a slightly off-the-wall question, but one that I think is im- 
portant. We know that, through a couple of different mechanisms, 
this information is now in the public domain. Are you or is anybody 
looking to see who has subsequently downloaded it? 

Ms. Rossides. I believe that is part of what the IC is looking at. 
We do know — we have in our — our CIO shop has done an initial 
review of who did download it and has it on their websites, the 
non-Covernment, non-DHS websites. We do know that. 

Mr. Himes. Thank you. Yes, no, I am just intrigued by the possi- 
bility that you might cross-check a list of those end-users, not just 
cross-posters, but end-users who downloaded it perhaps with other 
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lists that could — from which we could maybe make some infer- 
ences. 

When we get classified information on this committee, each page 
is usually marked with some degree of classification. Sometimes 
each paragraph has actually indicated some level of classification. 
Do you follow a similar protocol on a hard copy? Would SSI be al- 
ways indicated as such? 

Ms. Rossides. Yes, sir. If appropriately marked, the SSI docu- 
ment would be marked and the pages would have a header and a 
footer on them that said it is SSI information. 

Mr. Himes. Not having seen the SSI that was disclosed, was 
that, in fact, appropriately marked as such? 

Ms. Rossides. No, sir, it was not, no. That was part of the prob- 
lem. 

Mr. Himes. So the failure was one of marking. 

Ms. Rossides. And redacting. 

Mr. Himes. And redacting, okay. Do you have a sense for what 
your overall rate of compliance is with respect to marking appro- 
priately your documents? 

Ms. Rossides. Well, sir, we do a number of self-assessments as 
part of our SSI program, and we do those routinely. We also had 
a very extensive review by GAO at the end of 2007 who actually 
gave very good grade to TSA for how we do — our program office ad- 
dresses SSI. 

Mr. Himes. Thank you. I yield back the balance of my time. 

Ms. Jackson Lee. I thank the gentleman from Connecticut. 

I would like to now recognize Mr. Bilirakis for 5 minutes. 

Mr. Bilirakis. Yes, I will go ahead and ask my questions during 
the Executive Session, Madam Chairwoman. Thank you. 

Ms. Jackson Lee. Let me 

Mr. Dent. May I ask your indulgence. Madam Chairwoman? I 
know we have a few minutes before the vote, but before we go into 
Executive Session, I am struggling a little bit with the underlying 
premise of Ms. Rossides’ response. 

By refusing to give a document to this committee because you 
are concerned about public disclosure, that is implying that the 
subcommittee will disclose the document. That is what troubles me 
the most: The implication that this subcommittee is not taking se- 
curity of these documents that seriously, and I think we all agree 
that we know that is not the case. 

For the record, I am glad the inspector general is doing his inves- 
tigation, but that is not particularly relevant to our request for this 
document. We are a separate and equal branch of Government re- 
sponsible for overseeing TSA’s activities. I am frustrated by, again, 
a willingness to provide us a date certain for delivering this critical 
document to the subcommittee. 

So I feel like I have been left with no choice. I feel like we have 
given the administration every opportunity to provide this docu- 
ment. I appreciate the fact that our staff has been able to look at 
this for a few hours. 

I think, somewhat reluctantly, along with Ranking Member Bili- 
rakis, Mr. Lungren and Mr. King, and others, you know, I will be 
introducing a resolution of inquiry demanding that the Secretary 
provide the House of Representatives with this document. I think 
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it is only appropriate, and I would rather not do it. If I had a date 
certain, I would not ask for this resolution. 

Ms. Jackson Lee. The gentleman — if the gentleman’s finished 
his remarks — let me ask you. Administrator Rossides, if you have 
a definitive date or whether you could submit a definitive date of 
the completion of the IG report? 

Ms. Rossides. No, Madam. I am sorry. I do not. I do not know 
when the IG will definitively be finished. I know that they have 
this on an expedited track, but I don’t have a specific date. I 
couldn’t speak 

Ms. Jackson Lee. Do you have a close, proximate date? 

Ms. Rossides. All I know is when they first began the engage- 
ment and took it over from our office of inspection, they said they 
wanted to have it done in a matter of a couple weeks, so that they 
started that, you know, earlier, right after — they started it on De- 
cember 9. 

Ms. Jackson Lee. Okay, well, let me just say that I am very 
moved by the sincerity of Mr. Dent’s request and intent to offer a 
resolution of inquiry, but I am aware that the Chairman of the full 
committee has authority to move forward, and it would seem, Mr. 
Dent, that you would raise that question with the Chairman of the 
full committee. I think that would be the appropriate next step and 
not a resolution of inquiry. 

I might also say that part of our concern has been that, in dis- 
closing the SOP, it is possible for leaks. Of course, it sounds maybe 
that it is ironic that I would use the term leaks, because, obviously, 
we have had a breach. But there have been many, many Members 
of the House and the Senate that have asked for this document, 
and there is no doubt this is a high-profile document, but our job 
is to ensure that there are no further leaks equally egregious. 

So I would ask that you ask the Chairman of the full committee 
as a first step, but more importantly, I would say that I would like 
Ms. Rossides to come back in the next 24 hours, if she can be in 
touch with the Secretary and the IG, to get a more definitive time. 
I know answering today may be difficult, but I would think the in- 
spector general would be open to the fact that this is urgent. Mr. 
Dent has indicated it is urgent. There is a suggestion of a resolu- 
tion of inquiry, which I think is premature. 

But even so, that shows the urgency of the matter. We need to, 
in essence, respond to that. So I would suggest that the first re- 
sponse for Mr. Dent and his colleagues is a request to the Chair- 
man of the full committee, Mr. Thompson. Then I would want to 
have the additional information for our subcommittee as to the 
time that you believe this might occur. 

Ms. Rossides. Yes, ma’am, I will do that. 

Ms. Jackson Lee. The IG’s report. 

Mr. Dent. Madam Chairwoman, the only thing I would ask 

Ms. Jackson Lee. I yield to the gentleman for a response. 

Mr. Dent. The only thing I would ask, respectfully, is that we 
be given a date certain as to when we would receive this document, 
then I would quite happily withdraw the motion for the resolution 
of inquiry. I do feel that the inspector general investigation is irrel- 
evant to our request for that particular document. As I said pre- 
viously, we have received, many thousands of pages of sensitive 
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and security information, and I think our committee has handled 
them well and we certainly will make a request to the Chairman. 

I would just like to keep this resolution out there for consider- 
ation. Hopefully in the intervening time, we can get a date certain. 
If we were to get a date certain for the release of document, then 
we could at that time withdraw the resolution. 

Ms. Jackson Lee. I think we found some measure of reconcili- 
ation or a moment that we can reconsider. 

Let me quickly — I think there are one or two Members that are 
going to be here. I am continuing the hearing because of the time 
constraints of Ms. Rossides. So anyone that is interested in the — 
going forward on the Executive Session, they need to hurry back, 
because the first vote — let me just proceed — I assume all Members 
have gone forward. I will yield myself for a second round until we 
convene into the Executive Session. 

Do you believe that any actions taken by the individuals that you 
have put on administrative leave or have disposed of in another 
manner — and I do need to get a correct interpretation — were some 
of these individuals contract employees? 

Ms. Rossides. Madam Chairwoman, at the time in March 2009, 
one of the individuals was a contractor, but he is now a TSA em- 
ployee, and he is one of the five TSA employees that is on adminis- 
trative leave. 

Ms. Jackson Lee. Do you believe that any actions by these em- 
ployees was intentional? 

Ms. Rossides. I would have to wait for the IG report, but my 
honest assessment is no. 

Ms. Jackson Lee. But you 

Ms. Rossides. I think this was an accident. 

Ms. Jackson Lee. Your honest assessment is no, but you do not 
know? 

Ms. Rossides. I don’t know for sure until the IG gives us the re- 
port. 

Ms. Jackson Lee. One of the employees was a contractor, and 
you are representing to this committee that that individual is now 
employed. But are you also representing that that individual went 
through the normal security checks? 

Ms. Rossides. Yes. If he was hired as a TSA employee, he would 
have had a background check. 

Ms. Jackson Lee. What do we learn from the idea — not the idea, 
but the actual happening of this incident occurring in March 2009 
and this was exposed in the last 3 weeks? What do we learn from 
that? 

Ms. Rossides. I think that — 

Ms. Jackson Lee. As you answer that question, can you com- 
prehend the disappointment that we have in that issue? 

Ms. Rossides. Yes, Madam Chairwoman. I think there are a 
number of things that we learned from this. Our learnings from 
this are that we definitely need better processes in place and tight- 
er controls on how we handle sensitive information. In the size of 
TSA, as large of an organization it is, where this information is 
shared across the organization, we are going to have to make sure 
that we have designated personnel who are properly managing — 
and managing this information and treating it in the manner in 
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which it should he. We need to make sure that our personnel are 
trained and really truly understand. 

If there is a lesson that the entire TSA organization has learned 
in this, it shows that, you know, the accident or the mistake of one 
or a few can tremendously impact the whole agency and our credi- 
bility with the American public. So we are taking it very, very seri- 
ously. I think that our front-line officers, our FAMs, our inspectors, 
our TSOs are very much aware of their responsibility now because 
a document like this has been put out there. 

So I think there will be a number of lessons that we will learn. 
I also think that there are technology solutions that hopefully will 
come from the IG’s report about the right technology to use, the 
right versions to use when redacting information. 

Ms. Jackson Lee. Let me say this. I will recess this committee, 
and keeping in mind your schedule, we will return quickly, but my 
intent is to write legislation, first of all, with a great deal of respect 
for the reliance of this Government overall, not just Department of 
Homeland Security, on contract employees, from Blackwater em- 
ployees to a number of others. 

It is clear that there needs to be standards utilized for the hiring, 
retaining, and utilizing of contract employees. It will be my 
thought, it will be my legislative initiative to insist that contract 
employees not be used to handle Sensitive Security Information, 
period. 

Then we are looking to craft legislation that puts a firewall 
around certain technology, because as I was listening to the Chair- 
man, if this is unique technology that ultimately will prevent re- 
dacting from showing up again on a website, then I don’t want ran- 
dom individuals having access to that, because then you can be ex- 
ploited. 

So I will introduce legislation in the early part of the year to es- 
tablish that criteria, and we will also have to find a better pathway 
of informing the Members of this House and Senate, and I would 
imagine the White House, on issues of breach of security. 

With that, this hearing remains in recess. We may start back 
in — with a brief open session, but we will then go into the Execu- 
tive Session. Thank you. This hearing is now in recess. 

[Recess.] 

Ms. Jackson Lee. Committee is called to order. 

Ms. Rossides, I would like to pursue a line of questioning. This 
is not the Executive Session, which we will go into very shortly. 

Would you please share, again, with the explanation as to wheth- 
er or not we had a different software in March 2009, but we now 
have a different software in December 2009, dealing with this par- 
ticular issue? 

Ms. Rossides. Madam Chairwoman, I can’t answer that question 
with any specificity, because I do not know, and that is what the 
IG’s forensic team is looking at, as they are looking at all of the 
computers that were used by people in this action, so I cannot an- 
swer that. That will be part of the IG’s review. 

Ms. Jackson Lee. Do you have information — and if you have 
said it before, if you could say it again — that the policies of dealing 
with SSI have now changed, is there a review process of several in- 
dividuals that are now as we speak looking at Sensitive Security 
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Information and making a paper trail decision, meaning that you 
will know who made the decision, on what goes onto the weh? 

Ms. Rossides. Yes. That is really — I would give you a couple of 
answers to that. First of all, our procedures for how SSI informa- 
tion is handled internally is part of our review and our lessons 
learned. We will look again at those procedures. 

The SSI office maintains very detailed records of how they look 
at the documents and then how the documents are passed forward 
to other offices. The acquisition office is also looking at their proce- 
dures. Then most importantly, the CIO, our chief information offi- 
cer, is looking at both the technology that should be used across 
the whole agency in handling redacted material. We have actually 
asked the NSA to come in and help us ensure, give us a certifi- 
cation that any tool we use for redacting material electronically 
will meet their certification standards. So we are taking that added 
measure. 

Ms. Jackson Lee. As you do that, you are going to have written 
criteria, some roadmap to go forward on the handling of these ma- 
terials so that we can assure the American people that this will not 
happen again? 

Ms. Rossides. We will do a exhaustive review — and I commit to 
you that we will make sure we have procedures in writing that we 
train the appropriate personnel and that we raise every employee 
awareness about the importance of handling SSI material appro- 
priately. 

Ms. Jackson Lee. All right. As I indicated with respect to con- 
tractors, is there any determination that contractors would be out- 
side the realm of sensitive security materials? 

Ms. Rossides. No. Madam Chairwoman, right now, I believe that 
we do have some contractors that handle SSI material, but if they 
do, they are subject to the exact same procedures that any em- 
ployee in handling SSI is subject to. 

Ms. Jackson Lee. Well, I, frankly, believe that we should leave 
our SSI materials to employees of Homeland Security. I know that 
this Government has become very dependent in many areas — and 
in some areas, it is very effective. I have no problem with who 
builds our highways and bridges. It may be very difficult for the 
Government to engage in construction. 

But I certainly have concern about the use of non-Government 
employees in the handling of Sensitive Security Information. I am 
going to raise that with the Department. I am raising it with you. 
I would like you to raise it with your team. We will have to come 
to some resolution on that, because there is little reprimand, I be- 
lieve, under the circumstances for a contract employee who is get- 
ting paid by tax dollars, but then is, unfortunately, in a breach 
such as this, which we have not determined whether or not it was 
intentional. Certainly, I appreciate your representation at the level 
that it was at. 

Then final question before we enter into this session, the individ- 
uals that you were dealing with that have been, I guess, sus- 
pended — 

Ms. Rossides. Placed on administrative 

Ms. Jackson Lee [continuing]. Administrative leave, what level 
civil service rank would they have been at? What was their level? 
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Ms. Rossides. I would have to get back to you and confirm. They 
are at the mid-level and one, I believe, is at a senior management 
level. But I could have — I would have to confirm all — all five of 
them. I know that — that one, the high — the highest level one was 
at a senior management level. It is the K band in TSA’s pay sys- 
tem. 

Ms. Jackson Lee. Okay. With that in mind, thank you. The sub- 
committee will now resolve into Executive Session. I ask the clerk 
to prepare the room. 

[Whereupon, at 3:52 p.m., the subcommittee proceeded in Execu- 
tive Session, and subsequently adjourned the hearing at 4:14 p.m.] 
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